Add ability to query desktop process for its session ID by the network process

remoting/host/desktop_session_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "remoting/host/desktop_session_win.h"
 
 #include <sddl.h>
 
 #include <limits>
 #include <memory>
@@ skipping 43 matching lines @@
 
 // The security descriptor of the daemon IPC endpoint. It gives full access
 // to SYSTEM and denies access by anyone else.
 const wchar_t kDaemonIpcSecurityDescriptor[] =
     SDDL_OWNER L":" SDDL_LOCAL_SYSTEM
     SDDL_GROUP L":" SDDL_LOCAL_SYSTEM
     SDDL_DACL L":("
         SDDL_ACCESS_ALLOWED L";;" SDDL_GENERIC_ALL L";;;" SDDL_LOCAL_SYSTEM
     L")";
 
+// This security descriptor is used to give the network process, running in the
+// local service context, the PROCESS_QUERY_LIMITED_INFORMATION access right.
+// It also gives SYSTEM full control of the process and PROCESS_VM_READ,
+// PROCESS_QUERY_INFORMATION, PROCESS_TERMINATE, and READ_CONTROL rights to the
+// built-in administrators group.
+const wchar_t kDesktopProcessSecurityDescriptor[] =
+    SDDL_OWNER L":" SDDL_LOCAL_SYSTEM
+    SDDL_GROUP L":" SDDL_LOCAL_SYSTEM
+    SDDL_DACL L":"
+        SDDL_ACCESS_ALLOWED L";;" SDDL_GENERIC_ALL L";;;" SDDL_LOCAL_SYSTEM
+    L")("
+        SDDL_ACCESS_ALLOWED L";;0x21411;;;" SDDL_BUILTIN_ADMINISTRATORS
+    L")("
+        SDDL_ACCESS_ALLOWED L";;0x1000;;;" SDDL_LOCAL_SERVICE
+    L")";
+
 // The command line parameters that should be copied from the service's command
 // line to the desktop process.
 const char* kCopiedSwitchNames[] = { switches::kV, switches::kVModule };
 
 // The default screen dimensions for an RDP session.
 const int kDefaultRdpScreenWidth = 1280;
 const int kDefaultRdpScreenHeight = 768;
 
 // RDC 6.1 (W2K8) supports dimensions of up to 4096x2048.
 const int kMaxRdpScreenWidth = 4096;
@@ skipping 561 matching lines @@
       new base::CommandLine(desktop_binary));
   target->AppendSwitchASCII(kProcessTypeSwitchName, kProcessTypeDesktop);
   // Copy the command line switches enabling verbose logging.
   target->CopySwitchesFrom(*base::CommandLine::ForCurrentProcess(),
                            kCopiedSwitchNames, arraysize(kCopiedSwitchNames));
 
   // Create a delegate capable of launching a process in a different session.
   std::unique_ptr<WtsSessionProcessDelegate> delegate(
       new WtsSessionProcessDelegate(
           io_task_runner_, std::move(target), launch_elevated,
-          base::WideToUTF8(kDaemonIpcSecurityDescriptor)));
+          base::WideToUTF8(kDaemonIpcSecurityDescriptor),
+          base::WideToUTF8(kDesktopProcessSecurityDescriptor)));
   if (!delegate->Initialize(session_id)) {
     TerminateSession();
     return;
   }
 
   // Create a launcher for the desktop process, using the per-session delegate.
   launcher_.reset(new WorkerProcessLauncher(std::move(delegate), this));
 }
 
 void DesktopSessionWin::OnSessionDetached() {
@@ skipping 43 matching lines @@
                                 exploded.hour,
                                 exploded.minute,
                                 exploded.second,
                                 exploded.millisecond,
                                 passed.c_str());
 
   last_timestamp_ = now;
 }
 
 }  // namespace remoting